1. Scope of this notice
This notice applies to personal data processed through this public website, including enquiry forms and the newsletter. It does not replace separate notices used for formal membership, sports registration, medical documentation, safeguarding, image permissions or payment administration. Those processes may use separate official channels and notices.
2. Personal data we process
- Enquiry data: name, contact details, the type of request and information you choose to include in contact, trial, service or Pedibus enquiries.
- Pedibus data: where relevant, a child's first name and the details needed to route the request. The form should be submitted by a parent, guardian or otherwise authorised adult.
- Newsletter data: email address and information needed to record subscription and withdrawal choices.
- Technical and security data: limited connection, request and error information needed to deliver, secure and troubleshoot the service.
- Optional analytics data: only after consent, minimised usage information such as language, page path and broad categories of website interaction. Names, contact details, free-text form content, child data, query strings and form values are not used for analytics.
Please do not include health, payment or other special-category information in free-text fields unless the office has specifically asked for it through an appropriate channel.
3. Purposes and legal bases
- Enquiries and requested services: to receive, route and answer your request and, where relevant, take steps at your request before registration or another service relationship (GDPR Art. 6(1)(b)). General communications that are not pre-contractual are handled on the association's legitimate interest in answering genuine enquiries (Art. 6(1)(f)).
- Newsletter: to send news, activities and events after double opt-in confirmation, on the basis of consent (Art. 6(1)(a)).
- Optional analytics: to understand aggregate use of the website, only after analytics consent (Art. 6(1)(a)). Analytics are not used for advertising or individual profiling.
- Security and reliability: to prevent abuse, diagnose faults and protect the website and its users, on the basis of the association's legitimate interest in operating a secure and reliable service (Art. 6(1)(f)).
- Legal obligations and claims: where processing is required by law (Art. 6(1)(c)) or is necessary to establish, exercise or defend legal claims.
4. Required and optional information
Fields marked as required are necessary to send and handle the selected request. If required information is not provided, the website cannot submit that request. Optional fields may be left blank. The website does not use automated decision-making to accept or reject enquiries.
5. Recipients and service-provider categories
Data may be processed, where necessary for the relevant purpose, by providers supporting website hosting and infrastructure, public content and media, private form handling and storage, email and newsletter delivery, technical error monitoring, and optional analytics. Formal membership, registration and payment data is handled through the association's designated external registration/payment service rather than through the website enquiry database.
Data may also be disclosed to professional advisers or public authorities where required by law or where necessary to protect the association's rights.
6. Processing locations and international transfers
Some service providers or their subprocessors may operate from countries outside the European Economic Area. Where a restricted international transfer occurs, the association relies on the applicable GDPR Chapter V mechanism, such as an adequacy decision or appropriate contractual safeguards. Optional analytics are configured to use an EU-region service.
7. Retention
- Website enquiries: kept only for as long as needed to manage and follow up the request and, where relevant, meet legal obligations or protect the association's rights. Records should then be removed or anonymised when those purposes no longer require them.
- Security and abuse-prevention data: kept for the short operational period needed to protect the service; security/abuse-prevention records older than seven days are removed by the current service process.
- Newsletter: kept while the subscription is active; after withdrawal, minimum suppression information may be retained where needed to honour the opt-out and applicable obligations.
- Consent preference: kept for up to 180 days so the website can remember whether optional analytics were accepted or rejected.
- Optional analytics: retained for up to 12 months under the current analytics configuration.
- Technical error information: retained for the period reasonably necessary to diagnose and resolve technical problems, according to the applicable service configuration.
8. Your rights
Where applicable, you may request access, rectification, erasure, restriction or portability of your personal data, or object to processing. Where processing is based on consent, you may withdraw that consent at any time without affecting processing already carried out lawfully. Analytics consent can be changed through Cookie settings in the website footer.
Send data-rights requests to segreteria@polsanmamolo.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).
9. Security, minimisation and analytics choices
The association uses proportionate technical and organisational measures intended to limit access, reduce unnecessary data collection and protect the website against abuse. Optional analytics are disabled by default, use a minimised event set, do not create persistent analytics storage in the browser and can be rejected or withdrawn at any time.
10. Updates
This website notice is version 2026-08-27. Material changes to the website's data uses, tracking technologies or legal information require this notice to be reviewed and updated where necessary.